Packet Classification Techniques Research Articles

Packet Classification Using TCAM of Narrow Entries

Packet classification based on rules of packet header fields is the key technology for enabling software-defined networking (SDN). Ternary content addressable memory (TCAM) is a widely used hardware for packet classification; however, commercially available TCAM chips have only limited storage. As the number of supported header fields in SDN increases, the number of supported rules in a TCAM chip is reduced. In this work, we present a novel scheme to enable packet classification using TCAM with entries that are narrower than rules by storing the most representative field of a ruleset in TCAM. Due to the fact that not all rules can be distinguished using one field, our scheme employs a TCAM-based multimatch packet classification technique to ensure correctness. We further develop approaches to reduce redundant TCAM accesses for multimatch packet classification. Although our scheme requires additional TCAM accesses, it supports packet classification upon long rules with narrow TCAM entries, and drastically reduces the required TCAM storage. Our experimental results show that our scheme requires a moderate number of additional TCAM accesses and consumes much less storage compared to the basic TCAM-based packet classification. Thus, it can provide the required scalability for long rules required by potential applications of SDN.

A space- and power-efficient multi-match packet classification technique combining TCAMs and SRAMs

Packet classification is implemented in modern network routers for providing differentiated services based on packet header information. Traditional packet classification only reports a single matched rule with the highest priority for an incoming packet and takes an action accordingly. With the emergence of new Internet applications such as network intrusion detection system, all matched rules need to be reported. This multi-match problem is more challenging and is attracting attentions in recent years. Because of the stringent time budget on classification, architectural solutions using ternary content addressable memory (TCAM) are the preferred choice for backbone network routers. However, despite its advantage on search speed, TCAM is much more expensive than SRAM, and is notorious for its extraordinarily high power consumption. These problems limit the application and scalability of TCAM-based solutions. This paper presents a tree-based multi-match packet classification technique combining the benefits of both TCAMs and SRAMs. The experiments show that the proposed solution achieves significantly more savings on both memory space and power consumption on packet matching compared to existing solutions.

Comparison Study Of Packet Classification Algorithms In Wired Networks

The packet classification technique play an important role for many internet advanced services that require the capability to distinguish traffic in different flows, such as routers and security services like firewalls and packet filters. This paper provide a brief introduction for packet classification process. Beside, the categorization of the algorithms that classify packets to different flow. Also, this paper give a brief description of two homogenous algorithms (algorithms that belongs to same category), these algorithms are Tuple Space Search (TSS) and Recursive Flow Classification (RFC). Furthermore, this paper provides a comparative evaluation of these two algorithms (TSS & RFC). The evaluation of these techniques are done under Linux REDHAT 5.0 platform in order to analyze and compare their performance between each other. In particular, the comparison focuses on achieving a good classification time in classification process and, low memory consumption rate.

NoBot: Embedded malware detection for endpoint devices

NoBot is a novel malware detection system that employs packet classification and distinct counting techniques to achieve reliable detection and identification of malware by observing the traffic to and from a network-connected host. The solution is designed to be economically incorporated into endpoint devices, such as Ethernet switches, Gigabit passive optical network (GPON) devices, and digital subscriber line access multiplexers (DSLAMs) leveraging the integral features of the hosting device, such as packet classification, packet counting, packet-forwarding features, and the computing resources of the control processor. NoBot combines these features with deep packet inspection and distinct counting to detect the presence of malware with a low rate of false positive detections. The NoBot software has been incorporated into a Linux device driver, installed into an Android-based smart phone, and implemented as a preprocessor module for the open source Snort Intrusion detection and prevention System (IDS/IPS).

LOP: A packet classification architecture with higher throughput and lower power consumption than TCAM

Packet classification is an important method implemented in modern network processors used in embedded systems such as routers. Current software-based packet classification techniques exhibit low performance, prompting researchers to move their focus to architectures encompassing both software and hardware components. Some of the newer hardware architectures exclusively utilize Ternary Content Addressable Memory (TCAM) to improve the performance of rule matching. However, this results in systems with high power consumption. In this paper, we propose LOP, a novel SRAM-based architecture where incoming packets are compared against parts of all rules simultaneously until a single matching rule is found for the compared bits in the packets. LOP significantly reduces power consumption as only a segment of the memory is compared against the incoming packet. Despite the additional time penalty to match a single packet, parallel comparison of multiple packets can improve throughput beyond that of the TCAM approaches, while consuming significantly less power. Compared with a state-of-the-art TCAM implementation (throughput of 495 Million Search per Second (Msps)) in 65 nm CMOS technology, on average, LOP saves 43% of energy consumption with a throughput of 590 Msps. In addition, an analysis of how the area scales is provided.

Hierarchical packet classification using a Bloom filter and rule-priority tries

Packet classification techniques have received significant attention in the network literature over the past 10 years, due to its fundamental role in the Internet routers. In recent years, Bloom filter, which is an efficient data structure for membership queries, becomes popular in the network applications. Though Bloom filter allows an error called “false positives,” the efficiency and the space saving overweigh this drawback when the false positive rate is properly controlled. In this paper, we proposed a packet classification algorithm based on a hierarchical approach. While the same data structure is used both for the source and the destination prefix fields in most of other hierarchical packet classification algorithms, our proposed hierarchical packet classification algorithm uses a Bloom filter for the source prefix field and a trie structure for the destination prefix field. The Bloom filter is primarily employed to pre-filter the sub-strings of the source address which have no match for the source prefixes of a given rule set. For the sub-strings with a positive result from the Bloom filter, rule-priority tries constructed based on a destination prefix field determine the highest priority rule matching the input packet for entire rule fields. Since the Bloom filter requires a small amount of memory, it is implemented with an on-chip memory or a fast cache, and hence the off-chip memory accesses are not occurred in the first stage of the hierarchical approach in the proposed algorithm. The proposed packet classification algorithm also provides incremental update. To compare the performance of the proposed packet classification algorithm with other related algorithms, extensive simulations for various algorithms are performed. The simulation result shows that the proposed algorithm renders a better performance in terms of average and worst-case search performance and memory requirement.

Effective Bit Selection Methods for Improving Performance of Packet Classifications on IP Routers

This paper investigates fast Packet Classification techniques, where a large routing table is divided into many much smaller tables by an index key at first; the resulting small tables are much easier to search. A traditional way is to use the front bits as the index key, but we show it's not an effective way to divide a routing table. In this paper, we propose three bit selection methods for division. They can be implemented by CAM or hash structure. Simulations show that the bit selection methods decrease the delay of classification 50% compared to the traditional method. We also propose an optimized method which is adapted to the biased traffic pattern, which shows 70% improvement in our simulation.

An Advanced Packet Classification Technique for Next Generation Internet

An Advanced Packet Classification Technique for Next Generation Internet

Survey and taxonomy of packet classification techniques

Packet classification is an enabling function for a variety of Internet applications including quality of service, security, monitoring, and multimedia communications. In order to classify a packet as belonging to a particular flow or set of flows, network nodes must perform a search over a set of filters using multiple fields of the packet as the search key. In general, there have been two major threads of research addressing packet classification, algorithmic and architectural. A few pioneering groups of researchers posed the problem, provided complexity bounds, and offered a collection of algorithmic solutions. Subsequently, the design space has been vigorously explored by many offering new algorithms and improvements on existing algorithms. Given the inability of early algorithms to meet performance constraints imposed by high speed links, researchers in industry and academia devised architectural solutions to the problem. This thread of research produced the most widely-used packet classification device technology, Ternary Content Addressable Memory (TCAM). New architectural research combines intelligent algorithms and novel architectures to eliminate many of the unfavorable characteristics of current TCAMs. We observe that the community appears to be converging on a combined algorithmic and architectural approach to the problem. Using a taxonomy based on the high-level approach to the problem and a minimal set of running examples, we provide a survey of the seminal and recent solutions to the problem. It is our hope to foster a deeper understanding of the various packet classification techniques while providing a useful framework for discerning relationships and distinctions.